adulau/aha
1
0
Fork 0
mirror of https://github.com/adulau/aha.git synced 2024-12-27 11:16:11 +00:00
Code Issues Projects Releases Packages Wiki Activity

mm: pass mm to grab_swap_token

Browse source 
If a kthread happens to use get_user_pages() on an mm (as KSM does),
there's a chance that it will end up trying to read in a swap page, then
oops in grab_swap_token() because the kthread has no mm: GUP passes down
the right mm, so grab_swap_token() ought to be using it.

We have not identified a stronger case than KSM's daemon (not yet in
mainline), but the issue must have come up before, since RHEL has included
a fix for this for years (though a different fix, they just back out of
grab_swap_token if current->mm is unset: which is what we first proposed,
but using the right mm here seems more correct).

Reported-by: Izik Eidus <ieidus@redhat.com>
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Acked-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Hugh Dickins 2009-06-23 12:36:58 -07:00 committed by Linus Torvalds
parent 626f380d0b
commit a5c9b696ec
3 changed files with 22 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
include/linux/swap.h
View file

@ -298,8 +298,8 @@ extern int try_to_free_swap(struct page *);
struct backing_dev_info; struct backing_dev_info;
/* linux/mm/thrash.c */ /* linux/mm/thrash.c */
extern struct mm_struct * swap_token_mm; extern struct mm_struct *swap_token_mm;
extern void grab_swap_token(void); extern void grab_swap_token(struct mm_struct *);
extern void __put_swap_token(struct mm_struct *); extern void __put_swap_token(struct mm_struct *);
static inline int has_swap_token(struct mm_struct *mm) static inline int has_swap_token(struct mm_struct *mm)
@ -419,10 +419,10 @@ static inline swp_entry_t get_swap_page(void)
} }
/* linux/mm/thrash.c */ /* linux/mm/thrash.c */
#define put_swap_token(x) do { } while(0) #define put_swap_token(mm) do { } while (0)
#define grab_swap_token() do { } while(0) #define grab_swap_token(mm) do { } while (0)
#define has_swap_token(x) 0 #define has_swap_token(mm) 0
#define disable_swap_token() do { } while(0) #define disable_swap_token() do { } while (0)
static inline void static inline void
mem_cgroup_uncharge_swapcache(struct page *page, swp_entry_t ent) mem_cgroup_uncharge_swapcache(struct page *page, swp_entry_t ent)

2
mm/memory.c
View file

@ -2519,7 +2519,7 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
delayacct_set_flag(DELAYACCT_PF_SWAPIN); delayacct_set_flag(DELAYACCT_PF_SWAPIN);
page = lookup_swap_cache(entry); page = lookup_swap_cache(entry);
if (!page) { if (!page) {
grab_swap_token(); /* Contend for token _before_ read-in */ grab_swap_token(mm); /* Contend for token _before_ read-in */
page = swapin_readahead(entry, page = swapin_readahead(entry,
GFP_HIGHUSER_MOVABLE, vma, address); GFP_HIGHUSER_MOVABLE, vma, address);
if (!page) { if (!page) {

32
mm/thrash.c
View file

@ -26,47 +26,45 @@ static DEFINE_SPINLOCK(swap_token_lock);
struct mm_struct *swap_token_mm; struct mm_struct *swap_token_mm;
static unsigned int global_faults; static unsigned int global_faults;
void grab_swap_token(void) void grab_swap_token(struct mm_struct *mm)
{ {
int current_interval; int current_interval;
global_faults++; global_faults++;
current_interval = global_faults - current->mm->faultstamp; current_interval = global_faults - mm->faultstamp;
if (!spin_trylock(&swap_token_lock)) if (!spin_trylock(&swap_token_lock))
return; return;
/* First come first served */ /* First come first served */
if (swap_token_mm == NULL) { if (swap_token_mm == NULL) {
current->mm->token_priority = current->mm->token_priority + 2; mm->token_priority = mm->token_priority + 2;
swap_token_mm = current->mm; swap_token_mm = mm;
goto out; goto out;
} }
if (current->mm != swap_token_mm) { if (mm != swap_token_mm) {
if (current_interval < current->mm->last_interval) if (current_interval < mm->last_interval)
current->mm->token_priority++; mm->token_priority++;
else { else {
if (likely(current->mm->token_priority > 0)) if (likely(mm->token_priority > 0))
current->mm->token_priority--; mm->token_priority--;
} }
/* Check if we deserve the token */ /* Check if we deserve the token */
if (current->mm->token_priority > if (mm->token_priority > swap_token_mm->token_priority) {
swap_token_mm->token_priority) { mm->token_priority += 2;
current->mm->token_priority += 2; swap_token_mm = mm;
swap_token_mm = current->mm;
} }
} else { } else {
/* Token holder came in again! */ /* Token holder came in again! */
current->mm->token_priority += 2; mm->token_priority += 2;
} }
out: out:
current->mm->faultstamp = global_faults; mm->faultstamp = global_faults;
current->mm->last_interval = current_interval; mm->last_interval = current_interval;
spin_unlock(&swap_token_lock); spin_unlock(&swap_token_lock);
return;
} }
/* Called on process exit. */ /* Called on process exit. */